In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchive-devel | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade libarchive | Mar 24, 2020 | Nov 21, 2019 |
| Centos_linux | — | Upgrade bsdcat-debuginfoUpgrade libarchive-debuginfoUpgrade bsdtar-debuginfoUpgrade libarchiveUpgrade bsdcpio-debuginfoUpgrade libarchive-debugsourceUpgrade bsdtar | Nov 5, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libarchive | May 2, 2022 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libarchive | Nov 3, 2020 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libarchive | Sep 28, 2020 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Jun 3, 2020 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libarchiveUpgrade bsdtarUpgrade libarchive-devel | Feb 26, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/libarchive to version 3.4.1-11.4.19.0.1.1.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade libarchiveUpgrade bsdtarUpgrade libarchive-devel | Nov 12, 2020 | Nov 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Mar 12, 2021 | Nov 21, 2019 |
| Redhat_linux | — | Upgrade libarchive-debuginfoUpgrade libarchiveUpgrade bsdcpio-debuginfoUpgrade libarchive-develUpgrade bsdcat-debuginfoNo solution existsUpgrade bsdtarUpgrade libarchive-debugsourceUpgrade bsdtar-debuginfo | Nov 5, 2020 | Nov 21, 2019 |
| Suse | — | Upgrade libarchive13Upgrade bsdtarUpgrade libarchive-devel | Nov 18, 2021 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libarchive13Upgrade bsdtar (Ubuntu Pro)Upgrade bsdcpio (Ubuntu Pro)Upgrade libarchive-dev (Ubuntu Pro)Upgrade libarchive13 (Ubuntu Pro) | Mar 3, 2020 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub